KVKK privacy notice

The Turkish text is the primary text; the English text is informational.

1. Controller and scope

This notice is given under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Obligation to Inform.

Controller	Pyramid Works LLC ("Crossell"), organised under the laws of Pennsylvania, USA, a controller not established in Türkiye
Address	15 Wheatley Walk, Lansdale, PA 19446, USA
Requests	[email protected]

The controller is established abroad. Crossell is not established in Türkiye and has not yet appointed a controller representative there, so requests go to the e-mail address above (and to the postal address where shown) and are handled as described in section 7. This notice will be updated when a representative is appointed.

This notice is not a consent form. Using the service is not conditional on any explicit consent. Ticking "I have read the Privacy Notice" at sign-up or in the app only records that this information was given to you; it is not a permission and does not change the legal basis of any processing. Explicit consent is asked for only in section 8 (optional analytics and session recording) and can be withdrawn at any time.

Crossell acts in two roles: controller for its own account holders, team members, website visitors and form submitters (sections 2–8), and processor for the marketplace buyer data that reaches it from the sales channels a seller connects (section 9). For buyer data the seller is the controller.

2. Sellers and users: data categories (Crossell is controller)

Data subjects: (K1) account holders and team members, (K2) invitees, (K3) website visitors, (K4) people who submit the early-access, contact or feedback forms, (K5) people who sign the KVKK Module 2 standard contract for a seller.

Legal bases (KVKK Art. 5): 5/1 explicit consent; 5/2-c necessary for a contract; 5/2-ç legal obligation; 5/2-e establishing, exercising or defending a right; 5/2-f legitimate interest. No special-category data is intended.

Category	Example fields	Subjects	Purpose	Legal basis	Recipients	Abroad	Retention
Identity	Name, name from Google sign-in; signatory name and title; business name printed on documents (personal data for a sole trader)	K1, K5	Open and run the account; conclude the contract; prepare the standard contract	5/2-c; 5/2-ç	Hosting and backup; e-mail provider; public authorities incl. the KVKK Authority	Yes (US)	While the account is open; deleted 30 days after the deletion request (when the cancellation window ends); standard contract and signatory data for the relationship + 10 years
Contact	E-mail; invitation e-mail; early-access e-mail and store URL; feedback e-mail; document header address	K1, K2, K4	Account and security notices; invitations; replies; service information	5/2-c; 5/2-f	E-mail provider; hosting	Yes (US)	Account lifetime; invitations valid 7 days; early-access requests 12 months
Customer transaction	Plan and status; usage counters; support tickets, messages, attachments; feedback; in-app notifications; AI usage records (task, model, tokens, cost; not the prompt); the seller's own products, stock, prices, orders and reports	K1	Provide the service; support; plan limits; quality	5/2-c; 5/2-f	Hosting; e-mail provider (no ticket text); AI provider (prompt text only for an AI task the seller starts)	Yes (US)	Account lifetime; support attachments deleted 12 months after closure; support texts and notifications (period to be set)
Finance	Stripe customer/subscription ids and payment records (no card number reaches Crossell); tax office and tax number (may equal the Turkish ID number of a sole trader); marketplace settlement rows; uploaded bank statement rows	K1	Billing and accounting; seller's document headers; payout and bank reconciliation	5/2-c; 5/2-ç	Stripe; hosting	Yes (US)	Payment records for the statutory tax/commercial period (period to be set); others account lifetime
Transaction security	Password hash; MFA secret and recovery-code hashes; session cookie; hashed tokens; hashed IP and user agent at legal acceptance; audit and access logs; marketplace API keys / OAuth tokens and carrier credentials (AES-256-GCM); pseudonymous telemetry on our own SigNoz; server access logs (IP)	K1, K3	Information security; abuse prevention; incident review; working with connected stores	5/2-c; 5/2-ç (Art. 12); 5/2-f	Hosting and backup; authorities	Yes (US)	Credentials cleared on disconnect; session cookie 30 days; buyer-data access log on some channels ≥ 12 months; audit logs and server logs (period to be set)
Marketing	Sign-up source and campaign parameters; referral code; welcome e-mail sequence state; e-mail delivery events (opens and clicks are not recorded); first-party product-step events recorded on our server (sign-up, checkout, first store connection; with page path and browser user agent); consent only: Google Analytics 4 and PostHog measurement, masked session recording	K1, K3, K4	Channel measurement; promoting and improving the service; product analytics	5/2-f; 5/1 explicit consent (analytics cookies, recording); Law 6563 consent for commercial e-messages	E-mail provider; analytics providers	Yes (US; PostHog EU if on)	Account lifetime; analytics per provider setting (period to be set); collection stops when consent is withdrawn
Legal transaction	Which version of each legal text was accepted and when; Module 2 contract, signed files, signatory authority documents and event log; data subject requests	K1, K5	Legal obligations; evidence; disputes; notifications to the Authority	5/2-ç; 5/2-e	KVKK Authority; courts and authorities	Yes (stored in US)	Account lifetime + limitation period 10 years; Module 2 files relationship + 10 years
Visual/audio	Not processed on purpose; product images a seller uploads may show people and go to the AI provider in image tasks; session recording is not a screenshot	K1	Product image editing/analysis	5/2-c	AI provider	Yes (US)	Until the seller deletes them or the account closes
Location	No location data collected; Google Analytics may derive coarse location from IP if you consent; Crossell does not pass the IP to PostHog	K3	—	5/1	Google	Yes	Provider setting

Category: Identity
Example fields: Name, name from Google sign-in; signatory name and title; business name printed on documents (personal data for a sole trader)
Subjects: K1, K5
Purpose: Open and run the account; conclude the contract; prepare the standard contract
Legal basis: 5/2-c; 5/2-ç
Recipients: Hosting and backup; e-mail provider; public authorities incl. the KVKK Authority
Abroad: Yes (US)
Retention: While the account is open; deleted 30 days after the deletion request (when the cancellation window ends); standard contract and signatory data for the relationship + 10 years

Category: Contact
Example fields: E-mail; invitation e-mail; early-access e-mail and store URL; feedback e-mail; document header address
Subjects: K1, K2, K4
Purpose: Account and security notices; invitations; replies; service information
Legal basis: 5/2-c; 5/2-f
Recipients: E-mail provider; hosting
Abroad: Yes (US)
Retention: Account lifetime; invitations valid 7 days; early-access requests 12 months

Category: Customer transaction
Example fields: Plan and status; usage counters; support tickets, messages, attachments; feedback; in-app notifications; AI usage records (task, model, tokens, cost; not the prompt); the seller's own products, stock, prices, orders and reports
Subjects: K1
Purpose: Provide the service; support; plan limits; quality
Legal basis: 5/2-c; 5/2-f
Recipients: Hosting; e-mail provider (no ticket text); AI provider (prompt text only for an AI task the seller starts)
Abroad: Yes (US)
Retention: Account lifetime; support attachments deleted 12 months after closure; support texts and notifications (period to be set)

Category: Finance
Example fields: Stripe customer/subscription ids and payment records (no card number reaches Crossell); tax office and tax number (may equal the Turkish ID number of a sole trader); marketplace settlement rows; uploaded bank statement rows
Subjects: K1
Purpose: Billing and accounting; seller's document headers; payout and bank reconciliation
Legal basis: 5/2-c; 5/2-ç
Recipients: Stripe; hosting
Abroad: Yes (US)
Retention: Payment records for the statutory tax/commercial period (period to be set); others account lifetime

Category: Transaction security
Example fields: Password hash; MFA secret and recovery-code hashes; session cookie; hashed tokens; hashed IP and user agent at legal acceptance; audit and access logs; marketplace API keys / OAuth tokens and carrier credentials (AES-256-GCM); pseudonymous telemetry on our own SigNoz; server access logs (IP)
Subjects: K1, K3
Purpose: Information security; abuse prevention; incident review; working with connected stores
Legal basis: 5/2-c; 5/2-ç (Art. 12); 5/2-f
Recipients: Hosting and backup; authorities
Abroad: Yes (US)
Retention: Credentials cleared on disconnect; session cookie 30 days; buyer-data access log on some channels ≥ 12 months; audit logs and server logs (period to be set)

Category: Marketing
Example fields: Sign-up source and campaign parameters; referral code; welcome e-mail sequence state; e-mail delivery events (opens and clicks are not recorded); first-party product-step events recorded on our server (sign-up, checkout, first store connection; with page path and browser user agent); consent only: Google Analytics 4 and PostHog measurement, masked session recording
Subjects: K1, K3, K4
Purpose: Channel measurement; promoting and improving the service; product analytics
Legal basis: 5/2-f; 5/1 explicit consent (analytics cookies, recording); Law 6563 consent for commercial e-messages
Recipients: E-mail provider; analytics providers
Abroad: Yes (US; PostHog EU if on)
Retention: Account lifetime; analytics per provider setting (period to be set); collection stops when consent is withdrawn

Category: Legal transaction
Example fields: Which version of each legal text was accepted and when; Module 2 contract, signed files, signatory authority documents and event log; data subject requests
Subjects: K1, K5
Purpose: Legal obligations; evidence; disputes; notifications to the Authority
Legal basis: 5/2-ç; 5/2-e
Recipients: KVKK Authority; courts and authorities
Abroad: Yes (stored in US)
Retention: Account lifetime + limitation period 10 years; Module 2 files relationship + 10 years

Category: Visual/audio
Example fields: Not processed on purpose; product images a seller uploads may show people and go to the AI provider in image tasks; session recording is not a screenshot
Subjects: K1
Purpose: Product image editing/analysis
Legal basis: 5/2-c
Recipients: AI provider
Abroad: Yes (US)
Retention: Until the seller deletes them or the account closes

Category: Location
Example fields: No location data collected; Google Analytics may derive coarse location from IP if you consent; Crossell does not pass the IP to PostHog
Subjects: K3
Purpose: —
Legal basis: 5/1
Recipients: Google
Abroad: Yes
Retention: Provider setting

3. How we collect

From you (forms, Settings, invitations, support, Module 2 signing); automatically (session and security logs, cookies, analytics only with consent); from third parties (Google sign-in, Stripe, the sales channels you authorise).

4. Recipients

We do not sell personal data or share it for advertising. Recipients: Hivelocity, LLC (hosting, US); Cloudflare, Inc. (R2 backups and encrypted files, DNS, e-mail routing, US); Plus Five Five, Inc. (Resend, e-mail, US); Stripe (payments, US); OpenRouter, Inc. and through it Google Gemini, with OpenAI as a fallback on one task (AI, US); Google LLC (Analytics with consent; Google sign-in, US); PostHog (only when on, with consent, EU); e-Faturam (only when the seller issues an e-invoice, Türkiye); the sales channels the seller connects; public authorities where the law requires.

5. Transfers abroad (Art. 9 as amended by Law 7499, in force 1 June 2024)

Because Crossell is not established in Türkiye, processing the data of users in Türkiye on our servers and with our providers is a transfer abroad. The countries where data is processed are listed provider by provider on the sub-processor page. Servers and most providers are in the US; PostHog, if on, stores in the EU. With no adequacy decision for either, both are transfers abroad. Basis: the Board's standard contracts (Art. 9/4-c) notified within 5 business days of signature: Module 2 between Crossell and each provider for Crossell's own data; Module 2 between seller and Crossell and Module 3 between Crossell and its sub-processors for buyer data. Status: not yet signed. Explicit consent is not relied on: the Art. 9/6 exceptions cover occasional transfers only, and Crossell's transfers are continuous.

6. Retention

Approved periods (owner, 28 Oct 2026): (1) the seller's own answers: while the account is active (the buyer's name is removed from them after 2 years); (2) buyer questions and messages with the buyer's name: 2 years after the conversation's last message, then the name and every buyer identifier are removed and the question and answer text stays anonymised; (3) customer names on orders: while the account is active, erased with the account; (4) after account deletion: erased once the 30-day cancel window ends; (5) shipping-label files: 30 days. AI credits expire (Terms 6.4).

As in section 2, then deletion, destruction or anonymisation under the Retention and Destruction Policy. Database backups 30 days, weekly volume backups 84 days, point-in-time archive (period to be set); deleted data leaves backups at the latest when these periods end.

7. Your rights (Art. 11) and how to apply (Art. 13)

You may learn whether your data is processed and request information; learn the purpose and whether it is used accordingly; know the recipients in Türkiye or abroad; request correction; request deletion or destruction under Art. 7 and notification of that to recipients; object to an adverse result produced solely by automated analysis; and claim compensation for unlawful processing.

Google Analytics 4 and (when on) PostHog load only if you allow "Analytics"; otherwise they are never loaded. You can withdraw at any time through "Cookie settings"; measurement stops and their cookies are deleted. Session recordings are not screenshots; all text and form fields on app screens are masked, password fields are never recorded, and nothing is recorded on sign-in, sign-up, password, invitation, settings, admin and marketplace-connection pages. Your IP is not sent to PostHog; you are identified only by an irreversible server-side hash. Buyer names, addresses, phones or order amounts are never sent to PostHog. PostHog is off today.

9. Buyer data processed for sellers (Crossell is processor)

The seller is the controller of its buyers' data (the marketplace separately for its own copy); the seller sets the legal basis. Crossell never uses this data for its own purposes, never sells it and never trains AI models on it. The relationship is governed by the Data Processing Agreement and the KVKK Module 2 standard contract.

Category	Example fields	Purpose (on the seller's instruction)	Sub-processor / recipient	Abroad	Retention (in code today)
Identity	Buyer display name; irreversible buyer key (HMAC-SHA256); hashed username on some channels	Order and message handling; showing the same buyer's earlier conversations	Hosting, backup	Yes (US)	Order rows account lifetime; buyer fields on some channels (period to be set); cleared at once on a channel deletion notice
Contact	Buyer questions and messages, subject, attachments; orders.customer_email column (no current writer found)	Answering buyers; optional AI drafts and translation	Hosting, backup; AI provider (masked text)	Yes (US)	2 years after the last message the buyer's name, buyer key, channel buyer id and any name inside the text are removed; the question and answer text stays as an anonymous example
Address / location	Turkish channels: city, district, company/individual flag only; other channels: country, region, postal code; delivery address type code. Street address, phone and tax/ID number are not written to the database: read live at label/e-invoice time. Exception: the carrier label file (ZPL) is stored for 30 days and may contain buyer name and delivery address	Regional reports; shipping labels; e-invoices	Hosting, backup; e-Faturam (name and tax data at invoice time)	Yes (US); e-Faturam TR	City/region account lifetime; label files removed 30 days after creation; raw marketplace records 90 days
Customer transaction	Order number, lines, product, quantity, amount, currency, status, carrier and tracking number, package facts, payment method code (no card data), returns and claims, e-invoice number/ETTN and totals	Orders, stock, shipping, returns, finance reports; order actions the seller starts	Hosting, backup; the marketplace on the seller's instruction	Yes (US)	Account lifetime
Visual	Refund-request photos (only on a channel that provides them)	Refund review	Hosting	Yes (US)	At most 7 days

Category: Identity
Example fields: Buyer display name; irreversible buyer key (HMAC-SHA256); hashed username on some channels
Purpose (on the seller's instruction): Order and message handling; showing the same buyer's earlier conversations
Sub-processor / recipient: Hosting, backup
Abroad: Yes (US)
Retention (in code today): Order rows account lifetime; buyer fields on some channels (period to be set); cleared at once on a channel deletion notice

Category: Contact
Example fields: Buyer questions and messages, subject, attachments; orders.customer_email column (no current writer found)
Purpose (on the seller's instruction): Answering buyers; optional AI drafts and translation
Sub-processor / recipient: Hosting, backup; AI provider (masked text)
Abroad: Yes (US)
Retention (in code today): 2 years after the last message the buyer's name, buyer key, channel buyer id and any name inside the text are removed; the question and answer text stays as an anonymous example

Category: Address / location
Example fields: Turkish channels: city, district, company/individual flag only; other channels: country, region, postal code; delivery address type code. Street address, phone and tax/ID number are not written to the database: read live at label/e-invoice time. Exception: the carrier label file (ZPL) is stored for 30 days and may contain buyer name and delivery address
Purpose (on the seller's instruction): Regional reports; shipping labels; e-invoices
Sub-processor / recipient: Hosting, backup; e-Faturam (name and tax data at invoice time)
Abroad: Yes (US); e-Faturam TR
Retention (in code today): City/region account lifetime; label files removed 30 days after creation; raw marketplace records 90 days

Category: Customer transaction
Example fields: Order number, lines, product, quantity, amount, currency, status, carrier and tracking number, package facts, payment method code (no card data), returns and claims, e-invoice number/ETTN and totals
Purpose (on the seller's instruction): Orders, stock, shipping, returns, finance reports; order actions the seller starts
Sub-processor / recipient: Hosting, backup; the marketplace on the seller's instruction
Abroad: Yes (US)
Retention (in code today): Account lifetime

Category: Visual
Example fields: Refund-request photos (only on a channel that provides them)
Purpose (on the seller's instruction): Refund review
Sub-processor / recipient: Hosting
Abroad: Yes (US)
Retention (in code today): At most 7 days

AI: before a buyer message goes through OpenRouter to Google Gemini, names, e-mails, phone numbers, ID and order numbers are masked; this is pseudonymisation, not anonymisation. AI drafts are never sent without the seller's approval. A model paragraph for the seller's own notice is in the Turkish text.

10. Security (Art. 12)

HTTPS in transit; AES-256-GCM for credentials, tokens and carrier credentials; per-file envelope encryption for private files; passwords of at least 12 characters, changed every 365 days on every password account; optional TOTP for users, mandatory for admins; role- and feature-based team permissions with money withheld from restricted members; audit logs for admin actions and sensitive-field access; daily backups; firewall and intrusion detection on the server; masking before AI; data minimisation. Breaches are notified to the Board and data subjects within 72 hours as set by Board decision 2019/10.

11. Changes

A changed notice is published with a new date; material changes are e-mailed and need acceptance. Version: (period to be set).

To exercise a right under KVKK Article 11, use the request form. Data request form